trigger the publish workflow on an unpublished version (#212)

`release.yml` ran on every push to `master`: a full `make ci` (duplicating `build.yml`, which
already ran the same pipeline on the PR) followed by a `release` environment approval
request, whether or not the commit changed the version.

The workflow now asks crates.io whether the current version is published and does nothing
when it is. A commit-message gate ("release: ...") was considered and rejected: squash
merges replace the message with the PR title, which drops the prefix and makes the workflow
skip a real release while reporting success. The version not being on the index cannot be
lost by a merge strategy.

Also skip the workflow on forks, where it can only fail for lack of publish credentials
(reported in #147), and add `workflow_dispatch` to re-run a release that failed partway.

Author: jaemk

.github/workflows/release.yml

@@ -4,8 +4,59 @@ on:
     branches:
       - master
       - main
+  workflow_dispatch:
 jobs:
+  # Decide whether there is anything to release, from the actual signal: the crate's version is not
+  # on crates.io yet. Every push to master used to run the full `make ci` here and then ask the
+  # `release` environment for approval, whether or not the commit changed the version.
+  #
+  # This deliberately does NOT key off the commit message. A guard requiring the head commit to
+  # start with "release:" is silently defeated by squash-merging a release PR: the squash replaces
+  # the commit message with the PR title, the prefix is lost, and the workflow skips while still
+  # reporting success. A version that is not on the index is the condition that actually means
+  # "publish", and no merge strategy can lose it.
+  decide:
+    # Skip the whole workflow on forks: a contributor pushing to their own master has no `release`
+    # environment and no publish credentials, so the run could only fail or hang for them.
+    if: github.repository == 'jaemk/self_update'
+    runs-on: ubuntu-latest
+    outputs:
+      should_publish: ${{ steps.decide.outputs.should_publish }}
+      version: ${{ steps.decide.outputs.version }}
+    steps:
+    - uses: actions/checkout@v6
+    - name: Check whether the crate version is already published
+      id: decide
+      run: |
+        set -euo pipefail
+        version=$(cargo metadata --no-deps --format-version 1 \
+          | jq -r '.packages[] | select(.name == "self_update") | .version')
+        if [ -z "$version" ]; then
+          echo "Could not determine the crate version." >&2
+          exit 1
+        fi
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+
+        # A network or API failure must fail loudly rather than silently resolving to "nothing to
+        # publish", which would skip a real release.
+        body=$(curl -sS --fail-with-body \
+          -H "User-Agent: jaemk-self_update-release-workflow" \
+          "https://crates.io/api/v1/crates/self_update/versions")
+
+        if jq -e --arg v "$version" '.versions[] | select(.num == $v)' >/dev/null <<<"$body"; then
+          echo "self_update $version is already on crates.io - nothing to release."
+          echo "should_publish=false" >> "$GITHUB_OUTPUT"
+        else
+          echo "self_update $version is not on crates.io - releasing."
+          echo "should_publish=true" >> "$GITHUB_OUTPUT"
+        fi
+
   check:
+    needs: decide
+    # Only spend a full CI run when something is actually going out. `build.yml` already ran the
+    # same pipeline on the PR, but a release is the one place worth re-proving it against the
+    # merged tree.
+    if: github.event_name == 'workflow_dispatch' || needs.decide.outputs.should_publish == 'true'
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -17,7 +68,11 @@ jobs:
     - run: make ci
 
   publish:
-    needs: check
+    needs: [decide, check]
+    # Only request release-environment approval when there is actually a new version to publish (or
+    # on a manual dispatch, the escape hatch for re-running a release whose earlier attempt failed
+    # partway).
+    if: github.event_name == 'workflow_dispatch' || needs.decide.outputs.should_publish == 'true'
     runs-on: ubuntu-latest
     environment: release  # Optional: for enhanced security
     permissions:

CHANGELOG.md

@@ -20,6 +20,11 @@
   so it cannot leak into logs.
 
 ### Changed
+- The publish workflow now runs only when the crate version is not yet on crates.io, instead of on
+  every push to `master`. A push that does not bump the version no longer spends a full CI run in
+  `release.yml` (`build.yml` already covers it) and no longer requests `release`-environment
+  approval. The workflow also skips itself on forks, where it could only fail for lack of publish
+  credentials, and gains a `workflow_dispatch` trigger for re-running a release that failed partway.
 
 ### Fixed
 - `Extract::extract_file` (and so `bin_path_in_archive` on the update path) now finds an entry